2440 matches found
CVE-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
CVE-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
CVE-2026-13061
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
EUVD-2026-47800
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
PT-2026-63465
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can access session metadata of other users via the $listSessions aggregation stage. This data, which includes active session identifiers,...
CVE-2026-58149
Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...
CVE-2026-58149
The Joomla extension Events Booking (version
EUVD-2026-45200
The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...
CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...
CVE-2026-58149
Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...
CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...
PT-2026-60785
Name of the Vulnerable Software and Affected Versions Events Booking versions prior to 5.8.0 Description The Joomla extension Events Booking contains a flaw that allows an unauthenticated user to perform user enumeration. This issue enables an attacker to retrieve account usernames and email...
Oracle Linux 10 : openssh (ELSA-2026-19069)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19069 advisory. - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add...
A week in security (July 6 – July 12)
Last week on Malwarebytes Labs: This new Windows malware can take over your PC and wipe it clean How mule betting scams recruit ordinary people Two Chrome updates in two days fix critical vulnerabilities How World Cup crypto prediction sites take your money 6.9 million driver’s license numbers...
EUVD-2026-39508
File Browser: Authentication Bypass via Proxy Auth Header Forgery...
CVE-2026-15291
The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/id. This is due to the plugin not performing any...
MAL-2026-10086 Malicious code in dl-pp-latm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716 Package [email protected] registers both preinstall and postinstall lifecycle hooks that run index.js, which collects installer machine identifiers —...
CVE-2026-48492 Snipe-IT's selectlist visibility is too permissive
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/object/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web...
CVE-2026-48492 Snipe-IT's selectlist visibility is too permissive
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/object/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web...